nodejs/node · warning · Error

The ${key} option is protected, and cannot be retrieved in t

Error message

The ${key} option is protected, and cannot be retrieved in this way

What it means

`npm config get <key>` blocks reading values that isPrivate() flags as sensitive (auth tokens, passwords, _auth, _cert, etc.). This prevents secrets from being printed to stdout/logs. The value is still usable internally; it just cannot be retrieved this way.

Source

Thrown at deps/npm/lib/commands/config.js:202

      if (!this.npm.config.validate(where)) {
        log.warn('config', 'omitting invalid config values')
      }
    }

    await this.npm.config.save(where)
  }

  async get (keys) {
    if (!keys.length) {
      return this.list()
    }

    const out = []
    for (const key of keys) {
      const val = this.npm.config.get(key)
      if (isPrivate(key, val)) {
        throw new Error(`The ${key} option is protected, and cannot be retrieved in this way`)
      }

      const pref = keys.length > 1 ? `${key}=` : ''
      out.push(pref + val)
    }
    output.standard(out.join('\n'))
  }

  async del (keys) {
    if (!keys.length) {
      throw this.usageError()
    }

    const where = this.npm.flatOptions.location
    for (const key of keys) {
      this.npm.config.delete(key, where)
    }
    await this.npm.config.save(where)

View on GitHub (pinned to 1b2de5e052)

Solutions

Use `npm token list` for registry tokens rather than reading them from config
If you must inspect the value, read the specific .npmrc line directly and handle it as a secret (never log it)
Prefer a secret manager / npm_config_<key> env injection over storing retrievable tokens

Defensive patterns

Strategy: type-guard

Validate before calling

// Mirror npm's isPrivate check before calling config.get for display
function isPrivate(key, val) {
  const privateKeys = ['_authToken', '_auth', '_password', '_username', '_cert', '_key', '//']
  return privateKeys.some(p => key.includes(p)) || (typeof val === 'string' && /token|password|secret/i.test(val))
}

Type guard

function isProtectedConfigKey(key) {
  return [/_authToken$/, /_auth$/, /_password$/, /_username$/, /_keyfile$/, /_cert$/, /^\/\//].some(re => re.test(key))
}

Try / catch

try {
  out.push(npm.config.get(key))
} catch (e) {
  if (/protected/i.test(e.message)) { /* skip secret, do not log */ }
  else throw e
}

Prevention

Never echo auth config to logs or stdout
Use `npm token list` for registry tokens
Mark secret-bearing config in your own tooling and redact it

When it happens

Trigger: Running `npm config get` on a key like _authToken, _auth, _password, //registry/:_authToken, or any key classified private by isPrivate().

Common situations: Debugging registry auth; CI scripts that try to echo tokens for verification; automation that assumes all config keys are gettable.

Related errors

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/47d1d73866fec4a9. Report an issue: GitHub.